Danpol Community Forum

The "Header From" vs. "Envelope From" Disconnect

• 1. The Header From (The "Magic Field")
  This is the human‑readable display name and email address visible in your email client (e.g., From: "HR Dept" <info@yourcompany.com>). It is merely a field within the email's data, much like the subject line or body text. It can be easily spoofed. An attacker can put any address they wish here without verification during the initial connection phase.
• 2. The Envelope From (The Return‑Path)
  This is the true sender address, used exclusively by Mail Transfer Agents (MTAs) for routing the email and handling non‑delivery reports (bounces). This address is recorded in the final Return‑Path header by the receiving server. This is the address that email authentication standards actually verify.

The DMARC Solution and the "Spam Folder" Trap

The Challenge: Third‑Party Scanners and Default Behavior

• Default Exim Behavior: By default, Exim on cPanel accepts the email first and then passes the entire message body to third‑party content scanners like SpamAssassin.
• SpamAssassin's Role: SpamAssassin analyzes the headers (including DMARC failure status added locally by the server) and assigns a high "spam score." It is the score threshold, not the DMARC policy itself, that triggers the final action (moving to the spam folder).
• The Inefficiency: The email is still fully downloaded, processed, and stored, creating unnecessary resource usage and a psychological vulnerability where users might check their spam folders and fall for the phishing attempt.

Technical Implementation: Enforcing Immediate DMARC Rejection via Linux Shell

acl_smtp_rcpt

1. Access the Exim Configuration File
   The main configuration file is usually

   Code: Select all

   /etc/exim.conf

   .

   Code: Select all

   sudo nano /etc/exim.conf

2. Locate the

   Code: Select all

   acl_smtp_rcpt

   Section
   Scroll down in the file until you find the

   Code: Select all

   acl_smtp_rcpt:

   heading. This section handles recipient validation.
3. Insert the DMARC Denial Logic
   Place a deny condition early in the

   Code: Select all

   acl_smtp_rcpt

   list, ensuring it runs before generic accept or verify rules:
   

   Code: Select all

   # Enforce DMARC p=reject policy immediately
   deny
     condition = ${if and { \
       {eq{$dmarc_status}{fail}} \
       {contains{$dmarc_status_text}{p=reject}} \
     } {yes} {no}}
     message = 550 5.7.1 DMARC Verification Failed - Policy Reject (p=reject) - https://dmarc.org
   

4. Save Changes and Restart Exim
   On WHM:

   Code: Select all

   /scripts/restartsrv_exim

   
   
   On general Linux systems:

   Code: Select all

   sudo systemctl restart exim4

   
   or

   Code: Select all

   sudo service exim restart

Conclusion

opendmarc

General Outline of Steps Required

• Exim with DMARC support: Ensure your Exim binary was compiled with SUPPORT_DMARC enabled. This often means installing the opendmarc library and its development files through your operating system's package manager (apt, yum, etc.).
• Root/sudo access: You need administrative access to the server to install packages, edit configuration files, and set up cron jobs.
• Public Suffix List: Download the latest Mozilla Public Suffix List, which opendmarc uses during domain parsing, and place it in a location accessible by Exim, e.g.,

  Code: Select all

  /etc/exim/opendmarc.tlds

  .

/etc/exim/exim.conf

dmarc_history_file = /var/log/exim/dmarc_history
dmarc_tld_file = /etc/exim/opendmarc.tlds

control = dmarc_enable_forensic

dmarc_forensic_sender = postmaster@yourdomain.com

yum install opendmarc

apt install opendmarc-tools

#!/bin/sh
/usr/sbin/opendmarc-report -c /etc/opendmarc.conf -p /var/spool/exim/dmarc.pid

dmarc_history_file

Summary

What we tried

• Inserted ACL rules in both

  Code: Select all

  /etc/exim.conf

  and

  Code: Select all

  /etc/exim.conf.local

  to deny mail when

  Code: Select all

  $dmarc_status

  = fail and

  Code: Select all

  $dmarc_status_text

  contains

  Code: Select all

  p=reject

  .
• Verified placement in

  Code: Select all

  acl_smtp_data

  (the correct phase for DMARC enforcement).
• Rebuilt Exim configs and restarted services.

What happened

failed to expand ACL string ... unknown variable name "dmarc_status"

$dmarc_status

$dmarc_status_text

Why this matters

• WHM’s Email Deliverability interface suggests adding DMARC records, giving the impression enforcement is supported.
• In reality, Exim only evaluates SPF/DKIM and then passes spoofed mail through to SpamAssassin scoring.
• That means domains with

  Code: Select all

  p=reject

  policies can still be spoofed, and the mail will be accepted or rejected purely based on spam score.

The bottom line

• cPanel/WHM Exim does not enforce DMARC p=reject.
• Spoofed emails will be accepted unless they score high enough in SpamAssassin.
• The only way to enforce DMARC properly is to run

  Code: Select all

  opendmarc

  alongside Exim, or recompile Exim with DMARC support — neither of which is provided out-of-the-box by cPanel.

• Field: From
  Description: The human‑readable name/email the sender wants you to see.
  Importance: Easily forged!
• Field: Sender
  Description: The actual, traceable address used by mail servers for routing.
  Importance: Hard to forge!

The Power of the Visual Check